Secure FIDO Biometric Authentication via Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing devices face challenges in performing FIDO-compliant biometric authentication locally without a dedicated FIDO application, especially when connectivity is unavailable or a FIDO-compliant application is not installed, making it difficult for third-party programs to access and utilize biometric data for authentication.
Innovation Solution
A system and method for registering a biometric template locally on a computing device using an encrypted key stored in a trusted execution environment, allowing FIDO-compliant authentication to be performed securely and independently of external connectivity, with a biometric module generating a template from user-provided data and encrypting it using a cryptographic key pair.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If biometric data is stored in a computing device for authentication, then authentication security is improved, but accessibility of biometric data to application programs deteriorates
Solution Approach 1:
The system segments biometric data management into distinct components: a biometric authentication module that stores and processes biometric templates, and application programs that require authentication. The module acts as an independent security enclave that can be invoked by multiple applications without exposing raw biometric data, thus maintaining security while enabling broad accessibility.
Solution Approach 2:
The biometric authentication module serves as an intermediary between application programs and biometric data. Applications send authentication requests to the module, which processes them using stored biometric templates and returns authentication results. This intermediary architecture allows applications to access authentication functionality without directly accessing or storing sensitive biometric data.
2Reliability
If FIDO-compliant application is installed for biometric authentication, then authentication compliance is improved, but device complexity deteriorates
Solution Approach 1:
The biometric authentication module is designed as a universal component that implements FIDO compliance and can serve multiple application programs simultaneously. Rather than requiring separate FIDO-compliant applications for each use case, the module provides a single standardized interface that any application can invoke, reducing overall system complexity while maintaining compliance.
Solution Approach 2:
The biometric authentication module is configured to automatically perform FIDO-compliant authentication operations without requiring a dedicated FIDO application to manage it. The module self-manages its own security protocols, template storage, and authentication logic, allowing third-party applications to utilize biometric authentication without needing specialized programming or additional FIDO-specific software layers.
3Reliability
If biometric authentication is performed locally without external connectivity, then authentication reliability is improved, but adaptability to different authentication systems deteriorates
Solution Approach 1:
The biometric authentication module implements configurable parameters that allow it to adapt to different authentication requirements. It can adjust security levels, template formats, and communication protocols based on the specific application's needs, enabling local FIDO-compliant authentication to work across diverse systems without sacrificing reliability or connectivity independence.
Data Source
AI summary
A method for registration of a biometric template in a computing device includes: storing, in a first memory of a computing device, a biometric module; receiving, by an input device of the computing device, biometric data of a user; generating, by the biometric module of the computing device, a template based on the biometric data; generating, by a generation module of the computing device, a cryptographic key pair comprised of a private key and a corresponding public key using an encryption algorithm; encrypting, by an encryption module of the computing device, the generated template using the private key; storing, in a second memory of the computing device, the private key, wherein the second memory is a trusted execution environment; and storing, in the computing device, the encrypted template.